[bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[Gregory Maxwell]

On July 7th I will be making public details of several serious denial of
service vulnerabilities which have fixed in recent versions of Bitcoin Core,
including CVE-2015-3641.

I strongly recommend anyone running production nodes exposed to inbound
connections from the internet upgrade to 0.10.2 as soon as possible.

Upgrading older systems, especially miners, is also important due to the
BIP66 soft-fork which is about to reach enforcing status, see also:
http://sourceforge.net/p/bitcoin/mailman/message/34199290/

Re: [bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[Wladimir J. van der Laan]

On Sat, Jun 27, 2015 at 06:21:03AM +0000, Gregory Maxwell wrote:

> http://sourceforge.net/p/bitcoin/mailman/message/34199290/

New archive link:
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-June/008578.html

Wladimir

Re: [bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[Thomas Pryds]

[-- Attachment #1: Type: text/plain, Size: 363 bytes --]

Den 27/06/2015 08.21 skrev "Gregory Maxwell" <gmaxwell@gmail.com>:

> I strongly recommend anyone running production nodes exposed to inbound
> connections from the internet upgrade to 0.10.2 as soon as possible.

Does anybody know when/if 0.10.2 will be available on the Ubuntu PPA?

I could of course just install manually, but I like the convenience of a
PPA.

[-- Attachment #2: Type: text/html, Size: 504 bytes --]

Re: [bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[Jameson Lopp]

[-- Attachment #1: Type: text/plain, Size: 877 bytes --]

According to the release notes, the 0.10.2 release only had notable changes
for Windows. https://bitcoin.org/en/release/v0.10.2

It's not clear that there were any vulnerability patches in 0.10.2 itself
that apply to Ubuntu.

- Jameson

On Sat, Jun 27, 2015 at 1:55 PM, Thomas Pryds <thomas@pryds.eu> wrote:

>
> Den 27/06/2015 08.21 skrev "Gregory Maxwell" <gmaxwell@gmail.com>:
>
> > I strongly recommend anyone running production nodes exposed to inbound
> > connections from the internet upgrade to 0.10.2 as soon as possible.
>
> Does anybody know when/if 0.10.2 will be available on the Ubuntu PPA?
>
> I could of course just install manually, but I like the convenience of a
> PPA.
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>

[-- Attachment #2: Type: text/html, Size: 1614 bytes --]

Re: [bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[Thomas Pryds]

[-- Attachment #1: Type: text/plain, Size: 270 bytes --]

Den 27/06/2015 20.22 skrev "Jameson Lopp" <jameson.lopp@gmail.com>:
>
> According to the release notes, the 0.10.2 release only had notable
changes for Windows. https://bitcoin.org/en/release/v0.10.2

Ah, makes sense, then, that the PPA doesn't carry 0.10.2. Thank you.

[-- Attachment #2: Type: text/html, Size: 444 bytes --]

Re: [bitcoin-dev] Upcoming DOS vulnerability announcements for Bitcoin Core

[Gregory Maxwell]

On Sat, Jun 27, 2015 at 6:21 AM, Gregory Maxwell <gmaxwell@gmail.com> wrote:
> On July 7th I will be making public details of several serious denial of
> service vulnerabilities which have fixed in recent versions of Bitcoin Core,
> including CVE-2015-3641.
>
> I strongly recommend anyone running production nodes exposed to inbound
> connections from the internet upgrade to 0.10.2 as soon as possible.
>
> Upgrading older systems, especially miners, is also important due to the
> BIP66 soft-fork which is about to reach enforcing status, see also:
> http://sourceforge.net/p/bitcoin/mailman/message/34199290/


Just an update here-- I'm delaying this somewhat due to recent network
turbulance and unusual attempted DOS attack activity on relayed
infrastructure.
I've also had some requests from other cryptocurrency implementors to
use a somewhat longer horizon here.